fix(agentex-ui): bump sharp 0.34.3 -> 0.35.3 (GHSA-f88m-g3jw-g9cj)

[scale-prodsec]

Summary

Remediates GHSA-f88m-g3jw-g9cj (HIGH) in sharp, reported by Trivy against the agentex-ui image.

sharp < 0.35.0 inherits four libvips vulnerabilities:

• CVE-2026-33327
• CVE-2026-33328
• CVE-2026-35590
• CVE-2026-35591

sharp 0.35.0+ bundles the fixed libvips 8.18.3.

	Before	After
sharp	0.34.3	0.35.3
bundled libvips (@img/sharp-libvips-*)	1.2.0 (libvips 8.17.x)	1.3.2 (libvips 8.18.3)

Change

sharp is a transitive optionalDependency of [email protected] (declared ^0.34.3, which caps at <0.35.0). It is not a direct dependency and is not imported by application code. It is pinned via the existing npm overrides block in agentex-ui/package.json:

"overrides": {
  "sharp": "^0.35.0"
}

^0.35.0 resolves to the current latest 0.35.3. agentex-ui/package-lock.json was regenerated with npm 10 (matching CI's Node 20 toolchain); the diff is strictly the sharp transitive closure (the @img/sharp-* platform binaries, @img/sharp-libvips-*, @img/colour replacing color, and sharp's own semver/detect-libc floor bumps). No lockfileVersion/format migration, no file-mode changes, no application-code changes.

Transitive-pin safety

[email protected]'s image optimizer instantiates sharp as sharp(buffer, { limitInputPixels, sequentialRead }) — neither option was removed in 0.35.0. The APIs removed in 0.35.0 (failOnError constructor prop, paletteBitDepth metadata, format.jp2k rename) are not used by next 15.5.18, and the app declares no direct sharp usage nor next/image usage. sharp 0.35.0 requires Node ≥ 20.9.0, satisfied by the node:20-trixie-slim build/runtime base.

Validation

• npm ci in agentex-ui/ — passes (lockfile in sync; CI's exact install gate)
• npm run typecheck (tsc --noEmit) — passes
• Diff-scope verified: only sharp and its closure changed; color family removed cleanly (was consumed only by sharp)

Linear

Resolves GFDVR-20651 — [Trivy] Remediate sharp vulnerabilities
Covers child GFDVR-20652 — GHSA-f88m-g3jw-g9cj in [email protected]

🤖 Generated with Claude Code

Greptile Summary

Remediates GHSA-f88m-g3jw-g9cj by pinning the transitive sharp dependency from 0.34.3 to ^0.35.0 (resolved to 0.35.3) via npm overrides in package.json. The regenerated lockfile is cleanly scoped to the sharp transitive closure with no changes outside it.

• package.json: Adds \"sharp\": \"^0.35.0\" to the existing overrides block alongside the existing cross-spawn, postcss, and tar pins.
• package-lock.json: Updates sharp to 0.35.3, all @img/sharp-* platform binaries to 0.35.3, and all @img/sharp-libvips-* packages to 1.3.2 (bundling the fixed libvips 8.18.3). The color package and its dependents (simple-swizzle, is-arrayish) are removed and replaced by @img/colour. New platform targets (freebsd-wasm32, linux-riscv64, webcontainers-wasm32) are added as expected for the new minor.

Confidence Score: 5/5

Safe to merge — a targeted security override with no application code changes and a lockfile diff cleanly scoped to the sharp transitive closure.

The override correctly targets the vulnerable transitive dependency, resolves to the latest patched release, and the lockfile regeneration introduced no unrelated package changes. The removed color subtree and added platform targets are all expected consequences of the sharp 0.35.x minor. No application code, types, or other runtime paths were touched.

No files require special attention.

Important Files Changed

Filename	Overview
agentex-ui/package.json	Adds "sharp": "^0.35.0" to the existing overrides block, pinning the transitive sharp dependency to the patched version that bundles libvips 8.18.3.
agentex-ui/package-lock.json	Lockfile regenerated with sharp 0.35.3, @img/sharp-libvips-* 1.3.2, @emnapi/runtime 1.11.2; replaces color with @img/colour; removes simple-swizzle/is-arrayish; adds new platform targets (freebsd-wasm32, linux-riscv64, webcontainers-wasm32). All changes are strictly within the sharp transitive closure.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["agentex-ui/package.json\noverrides: sharp ^0.35.0"] -->|"npm ci resolves override"| B["[email protected]"]
    B --> C["@img/[email protected]\n(libvips 8.18.3 — patched)"]
    B --> D["@img/[email protected]\n(replaces [email protected])"]
    B --> E["detect-libc@^2.1.2\nsemver@^7.8.5"]
    F["[email protected]\noptionalDependency: sharp ^0.34.3"] -.->|"overridden by npm overrides"| B
    C -->|"bundles fixed libvips resolving"| G["CVE-2026-33327\nCVE-2026-33328\nCVE-2026-35590\nCVE-2026-35591"]
    style G fill:#d4edda,stroke:#28a745,color:#155724
    style A fill:#cce5ff,stroke:#004085,color:#004085
    style B fill:#fff3cd,stroke:#856404,color:#856404

Loading

_{Reviews (1): Last reviewed commit: "fix(agentex-ui): bump sharp 0.34.3 -> 0...." | Re-trigger Greptile}